vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait
概要
vaultwarden allows escalation of privilege via variable confusion in OrgHeaders trait
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organization. Hacker should know the ID of victim organization (in real case the user can be a part of the organization as an unprivileged user) and be the owner/admin of other organization (by default you can create your own organization) in order to attack. This vulnerability is fixed in 1.33.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com